exploiting-websocket-vulnerabilities

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's examples explicitly show embedding session tokens/cookies and token query parameters into command headers and URLs, which would require the agent/LLM to accept and output secret values verbatim (high exfiltration risk).

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The repository includes explicit, intentional PoC code and tooling that demonstrates stealing data via WebSockets (using stolen/replayed session cookies) and exfiltrating it to an attacker-controlled server, which is deliberate malicious behavior.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow in scripts/agent.py connects to a runtime-supplied target WebSocket/HTTP endpoint and ingests the server’s received text frames (outsider-authored responses) into the agent’s in-memory data structures (e.g., ws.recv()), which are then used to generate the final report; there is no LLM context shown, but the free text from the remote server is definitely read at runtime.